Skip to content
Bedrova bedrova
FeaturesCompatibilityDevelopersCompareDocs Coming soon

Docs

Model trust & verification

How Bedrova checks downloaded models, why remote code is off by default, and how to verify provenance.

A model you download is code and data from the internet. Bedrova treats it that way: new models are checked and quarantined before they can run, and the riskiest behavior — running arbitrary repo code — is off by default.

Quarantine

A downloaded or imported model starts quarantined. It can’t load until:

  • Its files verify (SHA-256 on download), and the manifest and license checks pass.
  • Its tokenizer, config, and chat template validate against what Bedrova expects for text models.
  • GGUF text models expose runnable llama.cpp metadata and stay text-only.
  • Core ML perception packages expose provenance, task metadata, and supported output shapes.

If a check fails, the model stays quarantined with a clear reason and, where possible, a repair action — rather than loading something half-broken.

Remote code is off

Some repos ship Python that they expect the runtime to execute (trust_remote_code). Bedrova disables this by default — no arbitrary repo code runs. Safetensors weights are preferred, and tokenizer/config/template files are validated rather than executed. A repo that needs remote code is flagged during discovery and held back; you decide, deliberately, whether to allow it.

Gated models

When a repo is gated, accepting its terms is recorded with the model so it’s clear you agreed, and your Hugging Face token (Keychain-stored, never echoed) authorizes the download.

Provenance and SBOM

Bedrova tracks where things came from so a build is auditable:

  • App provenance — build id, git SHA, and dependency locks.
  • Runtime/provider packs — signed manifests with hash checks and rollback protection.
  • Model provenance — the Hugging Face source and compatibility notes, carried in the model’s portable sidecar.
  • Conversion provenance — Core ML packages can record conversion/source metadata; GGUF imports can record source model and quant information when available.

App updates are Ed25519-signed through Sparkle; runtime packs use TUF-style signed manifests.

Verify it yourself

  • Check a model’s recorded source and hashes in its inspector.
  • Confirm Bedrova isn’t phoning home by watching its network calls.
  • Export a diagnostics bundle to see build id, git SHA, and pack versions.

See also